Compromised Systems Events Proven to be Originating from Testing Environments

Compromised Systems events that can be demonstrated to have originated from sandbox testing environments can be suppressed, regardless of their location within the network.

Event Suppression Request Process

To request Compromised Systems events that have originated from testing environments to be suppressed, contact Bitsight Support and provide sufficient evidence.

Required Evidence

Submit any of the following types of evidence (screenshots are accepted):

• Emails from sandbox testing software of such emails.
• Screenshots of the sandbox testing software.
• Logs from the sandbox testing software.

The evidence MUST include the following information:

• The malware family or identified threat.
• The target domain or target IP address.
• A timestamp that correlates with the finding under appeal.

Additional Information

We strongly encourage providing the following types of evidence:

• Binaries of the malware. These can be encrypted and forwarded or uploaded to malware detection tools, such as VirusTotal.
• Hashes of the malware binaries.
• All relevant logs.